Google just fixed 107 security flaws in Android — including two that hackers already used in real attacks.

The exploited bugs (CVE-2025-48633 & CVE-2025-48572) affect the Android Framework and could expose data or give attackers higher access.

ShadyPanda quietly turned trusted Chrome and Edge extensions into spyware.

Over 4.3 million installs in 7 years — some were even once verified by Google.

After silent updates in mid-2024, they began sending users’ browsing data and cookies to remote servers.

Tomiris is back — and harder to spot.

Kaspersky reports the group is using Telegram & Discord as C2 servers to hide attacks on government networks in Russia & Central Asia.

Its new malware — written in Python, Rust, Go, PowerShell & C#.

Security is an illusion.

“Sleeper” browser extensions woke up as spyware on 4 million devices.

Microsoft Defender portal outage disrupts threat hunting alerts.

MuddyWater strikes Israel with advanced MuddyViper malware.

GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools.

Researchers Capture Lazarus APT's Remote-Worker Scheme Live on Camera.

University of Pennsylvania confirms new data breach after Oracle hack.

University of Pennsylvania joins list of victims from Clop's Oracle EBS raid.

Everest Ransomware Claims ASUS Breach and 1TB Data Theft.

ChatGPT is down worldwide, conversations disappeared for users.

Malicious Rust Crate Delivers OS-Specific Malware to Web3 Developer Systems.

Marquis data breach impacts over 74 US banks, credit unions.

GoldFactory Hits Southeast Asia with Modified Banking Apps Driving 11,000+ Infections.

Record 29.7 Tbps DDoS Attack Linked to AISURU Botnet with up to 4 Million Infected Hosts.

reedom Mobile discloses data breach exposing customer data.

French DIY retail giant Leroy Merlin discloses a data breach.

Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution.

Sanctioned but Still Spying: Intellexa’s Prolific Zero-Day Exploits Continue.